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stated herein and/or any information regarding the application of the device, Infineon Technologies hereby 
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non-infringement of intellectual property rights of any third party. 

Information 

For further information on technology, delivery terms and conditions and prices please contact your nearest 
Infineon Technologies Office (www.infineon.com). 

Warnings 

Due to technical requirements components may contain dangerous substances. For information on the types in 
question please contact your nearest Infineon Technologies Office. 

Infineon Technologies Components may only be used in life-support devices or systems with the express written 
approval of Infineon Technologies, if a failure of such components can reasonably be expected to cause the failure 
of that life-support device or system, or to affect the safety or effectiveness of that device or system. Life support 
devices or systems are intended to be implanted in the human body, or to support and/or maintain and sustain 
and/or protect human life. If they fail, it is reasonable to assume that the health of the user or other persons may 
be endangered. 
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1 Introduction 


1.1 Bootable Interfaces 

Table 1 describes the interfaces the internal boot ROM code can boot from. In direct boot mode both CPUs access 
the external FLASH connected to the EBU. The external startup code needs to take care of all startup related 
issues (exception handling, CPU dispatching). This boot mode is intended as fallback or for special applications. 
All other boot modes will be supported by the internal boot ROM code. In this mode all exceptions will cause both 
CPUs to jump to the exception handler located in the ROM by default. 


Table 1 CPUO Boot Sources 


CFG(2:0) 

Primary 

Secondary 

Remark 

000 

EBU 



001 

BootROM 

ASC0 

Serial X-Modem bootstrap 

010 

BootROM 

SPI0 (gen.) 

SPI bootstrap, EEPROM command set 

011 

BootROM 

SPI0 (ATMEL) 

SPI bootrstrap, ATMEL command set 

100 

BootROM 

EBU NAND (small) 

528byte (small page) NAND 

101 

BootROM 

EBU NAND (large) 

21 12byte (large page) NAND 

110 

BootROM 

reserved 

Reserved 

111 

BootROM 

reserved 

Reserved 
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Table 2 CPU1 Boot Sources 


CFG(2:0) 

Primary 

Secondary 

Remark 

000 

EBU 



001. .111 

BootROM 

SDRAM 

Boot vector location read from VRAM 


When CFG2:0 equals 000, both CPUs directly boot from external FLASH memory. Since the boot process is 
handled by the external code completely, this case is not described within this document. Nevertheless CPUO may 
change the CFG settings by software, therefore changing CPU1 boot mode. For all cases where CFG2:0 is not 
equal to 000, both CPUs will fetch instructions from the boot ROM after reset and for certain exceptions. 
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2 Implementation 


2.1 Boot Core 

The boot core is written in assembler and takes care of 

• MIPS24KEc initialization 

• Cache initialization 

• CPU exception handling 

• CPU dispatch 

• Low-level boot error signalling 

All of the BootROM code is executed on exception level, so it is up to the subsequent boot code to take care for 
entering normal operation. The CPU enters the state “HALT” in case of any unhandled exception, which actually 
means updating the “BOOT_STATUS” field in the status register (described later on) and entering an infinite loop. 
In case of an EJTAG exception the CPU executes a DERET in addition to allow usage of the debugger. 
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RESET 

NMI 

OxBFCOOOOO 


TLB Refill 

(BEV=1 , EXL=0) 

0xBFC00200 


Interrupt 

Others 

0xBFC00380 


f EJTAG (ProbEn-0 
l 0xBFC00480 


> 


/ EJTAG (ProbEn=1)\_ 


BootROM / \ 

SW HANDLER j 


BOOTROM IRQVEC 


Figure 1 BootROM Exceptions 

All information needed by the BootROM is stored in the upmost section of the internal Multi Processor System 
(MPS) memory. The defined fields and their function are listed in the subsequent table. 


Table 3 MPS Memory BootROM Content 


Register 

Description 

BOOT_RVEC 

Start address to jump to after reset. Will be filled by BootROM for CPUO and has to be filled 
by CPUO for CPU1. 

BOOTNVEC 

Start address to jump to after NMI. 
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Table 3 MPS Memory BootROM Content (cont’d) 


Register 

Description 

BOOT_EVEC 

Start address to jump to after EJTAG exception. 

CP0_CAUSE 

MIPS CPU register, will be dumped on HALT condition. 

CP0EEPC 

MIPS CPU register, will be dumped on HALT condition. 

CP0_EPC 

MIPS CPU register, will be dumped on HALT condition. 

BOOTSIZE 

Only valid for CPU1 - contains the size of the FW code for memory mapping and optional 
decryption. Has to be filled by CPU0 for CPU1. 

BOOTRCUSR 

Only valid for CPU0 - contains the value for register RCU_SR on boot of CPU0. 

BOOTCONFIG 

Configuration word latched in during boot (content of RSTSR » 1), or boot configuration 
tag like read from boot media as soon as first tag is processed. 

BOOTSTATUS 

BootROM status and error information; should contain latest operation or error code. 


The register set is duplicated for both CPUs, resulting in the layout shown in Figure 2. 


0x01 FC 
0x01 F8 
0x01 F4 
0x01 F0 
0x01 EC 
0x01 E8 
0x01 E4 
0x01 E0 
0x01 DC 
0x01 D8 
0x01 D4 
0x01 DO 
0x01 CC 
0x01 C8 
0x01 C4 
0x01 CO 


BOOT_CONFIG BOOT_STATUS 


BOOT_NVEC 


BOOT_CONFIG | BOOT_STATUS 

BOOT_RCU_SR 


BOOT_EVEC 


BOOT_RVEC 


MPS MEMORY CONTENT 


Figure 2 MPS Memory BootROM Content 
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2.2 BootROM Modules 


2.2.1 Bootstrap CMD 

Due to the implementation of INCA-IP2 the external boot medium needs to contain information about SDR/DDR 
SDRAM memory setup before first memory access. Therefore the boot loader expects a special command 
structure as depicted in following figure. The data format is common for all bootstrap capable interfaces, so that 
the same binary image can be used independent from the boot source. 

The command module accepts three types of commands: 

• Register configuration (REGCFG) 

• Code download (DWNLD to external memory) 

• Start code execution (START) 

All commands share a 32-bit tag and the 32-bit length field, containing the number of bytes in the data field. The 
tag consists of two 16 bit words that add up to OxFFFF for easy validity checking. The content of the data section 
is defined by the respective command and described later on. 
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Common format: 



Config format: 

32 0 

REGCFG 

LENGTH 

ADDR 

VALUE 

ADDR 

VALUE 


Download format: 

32 0 

DWNLD 

LENGTH 

ADDR 


CODE 


Start format: 

32 0 

START 

LENGTH 

ADDR 


BOOTROM FORMAT 


Figure 3 Bootstrap CMD Structure 
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Register Configuration (REGCFG, CMDID=0x22) 

The “REGCFG” command is supplied in order to do SDRAM controller configuration and any other register 
settings that might be necessary on boot (e.g. workaround). It consists of 32 bit pairs containing register address 
(“ADDR”) and value to write (“VALUE”), which will be parsed sequentially until the number of 32 bit words (stored 
in “LENGTH”) is reached. There is no address verification or value checking implemented. 

SDRAM Download (DWNLD, CMDID=0x55) 

The download command copies the amount of data specified by field “LENGTH” to the address “ADDR”, reading 
back certain memory locations in order to detect memory failures. The bootloader assumes that the SDRAM has 
been set up before this command is executed (e.g. using “REGCFG” command). 

Code Execution (START, CMDID=0x77) 

After successful configuration of the memory interface and downloading the code, the START command will cause 
the CPU to jump to the specified address. 

2.2.2 SPI 

The SPI module allows boot strap of devices conforming to SPI mode 0. The default speed of the interface will be 
limited to 1 MHz to allow booting from all types of devices. To speed up the actual download the maximum 
supported interface speed can be provided using a small application executed in MPS memory. The separate boot 
mode for ATMEL devices supports a different commandset (read command 0x8E), while the generic mode will 
use the wide spread command set where read is represented by “0x03”. To achieve compatibility with most 
devices concerning address length, the loader will probe the number of expected address bytes. This is done by 
counting the address byte(s) 0x00 following a read command as long as no data is received. Therefore the first 
byte in serial FLASH memory needs to be different from OxFF. 

2.2.3 ASC 

The ASC boot strap uses the X-Modem protocol to download the commands on the serial interface. The default 
settings of the ASC are 115200 baud, no parity, 1 stop bit. The module either supports standard X-Modem (128 
byte frames, simple checksum) or X-Modem 1k(1024 byte frames, CRC16) for higher throughput. Since X-Modem 
allows up to 1 minute delay after transmitting the first frame, the memory setup commands (REGCFG or IDWNLD) 
need to fit into the first 128 or 1024 byte depending on used X-Modem speed. This assures that the following 
transmission succeeds, since X-Modem has no defined flow control. 

2.2.4 NAND 

The NAND FLASH module allows booting from a standard NAND memory with “guaranteed correct" block 0. The 
BootROM includes neither ECC checking/correction nor bad block handling algorithms. Therefore the executed 
software needs to fit into this boot sector (16k for small, 64k for large page NAND) and a two level loader approach 
needs to be used. The NAND FLASH boot process for a Linux kernel is depicted in the following illustration. 
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BootROM~ 


> 


BootROM configures memory interface and copies boot loader code from NAND 
FLASH to external RAM (no ECC/bad block handling; 



2nd level loader copies image from NAND to external RAM 
( with ECC/bad block handling) 


I 


U-Boot 


> 


Full-featured Bootloader (network updates, 
debug, etc.) starts operating system 


Linux 


> 


Figure 4 NAND Kernel Boot 
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3 Image Generation 


CPUO expects to receive the images on the boot strap interfaces compliant to the message format described in 
the previous chapters. Infineon provides an image generator for converting standard binaries into the format used 
by the INCA-IP2 BootROM. 


3.1 mkbootimg.incaip2 


The mkbootimg tool is provided with the INCA-IP2 BSP and can be run on any Linux machine. It has to be called 
like 

# mkbootimg . incaip2 <outfile> < <configfile> 

whereas <outfile> is the name of the image to generate and <configfile> is image description. Please note that the 
memory controller initialization must be done before issuing any download command and that the register 
configuration needs to fit into the first block of the used boot interface. 

3.1.1 Valid Tokens 

The image description language consists of a combination of the following tokens. The tokens may contain single- 
line comments enclosed with 1 ** 1 . 

3.1. 1.1 TAGREGCFG 

The token TAG_REGCFG allows setting one or more internal register(s) specified by <address> to <value>. There 
is no address validation done in the BootROM. 

TAG_REGCFG ( < f 1 ag> ) 

{ 

<address> <value> 


[<address> <value>] 


} ; 


3.1. 1.2 TAG_DWNLD 

The token TAG_DWNLD allows to download the binary image specified by <filename> (needs to be in quotes, e.g. 
“image.bin") to the address specified by <address>. The BootROM will halt in case the given address can not be 
written since the memory controller configuration is invalid. Please make sure that the executable image has been 
compiled for execution in memory at the same location. 

TAG_DWNLD ( < f 1 ag> ) 

{ 

<address> <filename> 


} ; 


3.1. 1.3 TAG_START 

The token TAG_START allows to start the binary image at location <address> - the BootROM will perform a direct 
jump. The BootROM does not check the specified location for valid code. 

TAG_START ( < f 1 ag> ) 

{ 


<address> 


} ; 
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3.1.2 Valid Flags 

Each of the tokens described above may contain one ore more of the following flags. 

3.1. 2.1 FLAG_SDBG 

The token FLAG_SDBG allows to enable several debug prints on interface ASCO. This option must not be used 
forX-Modem bootstrap, since the prints will disturb the serial protocol. 

Example : 

TAG_REGCFG (FLAG_SDBG) 

{ 

<address> <value> 

} ; 

3.1. 2.2 FLAG_START 

The token FLAG_START allows to start the binary <fi!ename> at location <address> after download. The 
BootROM will be continued after the called routine issues a return instruction. 

Example : 

TAG_DWNLD (FLAG_START) 

{ 

<address> <filename> 

}; 
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3.1.3 Configuration example 

The following configuration file example will generate an image that 

• configures the memory controller for SDRAM access 

• downloads the U-Boot to SDRAM memory 

• starts the U-Boot 


/* Example image file for INCA-IP2 image generator 
/* Don't use multi-line comments... 

TAG_REGCFG ( ) 


{ 


0xBF800060 
0xBF800200 
0xBF80023 0 
0xBF800220 
0xBF800240 
0xBF800280 
0xBF800290 
0xBF8002A0 
0xBF800210 


0x00000006 

0x00000802 

0x00000002 

0x00000020 

0x000014C9 

0x00036325 

0x00000C30 

0x00000000 

0x00000001 


/* 

/* 

/* 

/* 

/* 

/* 

/* 

/* 

/* 


MC_CON 

MC_IOGP 

MC_CFGDW 

MC_MRSCODE 

MC_CFGPB0 

MC_LATENCY 

MC_TREFRESH 

MC_SELFRFSH 

MC_CTRLENA 


*/ 

*/ 

*/ 

*/ 

*/ 

*/ 

*/ 

*/ 

*/ 


TAG_DWNLD ( ) 

{ 

0x80f00000 "u-boot .bin" /* Download u-boot image */ 


TAG_START ( ) 

{ 

0x80f00000 /* Start u-boot image */ 


User’s Manual 
BootROM 


14 


Revision 1.1, 2006-07-28 


'Infineon 


CONFIDENTIAL 


INCA-IP2 

BootROM 


Image Generation 


The content of the generated image might be (commands marked blue): 


0000000 

0000020 

0000040 

0000060 

0000100 

0000120 

0000140 

0000160 

0000200 

0000220 


2200ddf f 
bf 800200 
bf 800220 
bf 800280 
bf 8002a0 
5500aaf f 
00000000 
00000000 
00000000 
00000000 


00000048 bf 800060 00000006 
00000802 bf 800230 00000002 
00000020 bf 800240 000014c9 
00036325 bf 800290 00000c30 
00000000 bf 800210 00000001. 
000265f 8 80f 00000 ffOOOOlO 
fdOOOOlO 00000000 C4400000 
75010010 00000000 73010010 
71010010 00000000 6f 010010 
6d010010 00000000 6b010010 


0463060: e033f280 0034f280 3035f280 10000000 
0463100: 01000000 cc01fl80 3435f280 00000000 
0463120: 770088ff 00000004 80f00000 
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